{"id":"CVE-2026-125756","kind":"vulnerability","aliases":["CVE-2026-125756"],"related":[],"title":"postal-mime: address parser truncates domain, letting spoofed sender pass checks","description":"postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.","summary":"postal-mime before 4.2.1 truncates the sender domain in its address parser when folding whitespace or comments precede a dot. An attacker can craft a From header that passes SPF, DKIM and DMARC for their own subdomain while the parsed sender shows a spoofed victim address.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-parsing","node","package","postal-mime"],"not_affected_if":["sender-not-trusted","version-4.2.1-or-later"],"how_to_check":"- Check the installed postal-mime version in your lockfile or with `npm ls postal-mime`\n- Look for code that calls `PostalMime.parse()` and trusts the parsed `from` address for authorization or display decisions","fix":"- postal-mime: upgrade to `4.2.1` or later","status":"open","published_at":"2026-11-10T16:17:22+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:24+00:00","updated_at":"2026-11-10T16:23:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T16:23:24Z","model":"claude-haiku-5-5","output":{"fix":"- postal-mime: upgrade to `4.2.1` or later","reach":"internet","title":"postal-mime: address parser truncates domain, letting spoofed sender pass checks","impact":"medium","summary":"postal-mime before 4.2.1 truncates the sender domain in its address parser when folding whitespace or comments precede a dot. An attacker can craft a From header that passes SPF, DKIM and DMARC for their own subdomain while the parsed sender shows a spoofed victim address.","audience":"developers","category":"package","nicknames":[],"who_cares":["postal-mime","node","email-parsing"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker impersonates a victim sender and passes email authentication checks","analyst_note":"","how_to_check":"- Check the installed postal-mime version in your lockfile or with `npm ls postal-mime`\n- Look for code that calls `PostalMime.parse()` and trusts the parsed `from` address for authorization or display decisions","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.2.1-or-later","sender-not-trusted"],"who_is_affected":"Applications that parse inbound email with postal-mime and use the parsed From address for trust, routing or access decisions. Systems that only store or forward mail without relying on the sender field are less exposed. unknown whether other sources add more detail.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4632,"output_tokens":523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125756':15A,18A '-2026':14A,17A '4.2.1':31B,78C 'address':4A,38B,73B,86C,121C 'align':109C 'attack':49B,101C 'check':12A 'comment':44B,96C 'contain':79C 'craft':51B,103C 'cve':13A,16A 'differenti':82C 'dkim':58B 'dmarc':60B 'domain':7A,35B,91C 'dot':47B,99C 'email':20B 'email-pars':19B 'fold':41B,93C 'header':54B,105C 'let':8A 'mime':3A,26B,29B,76C 'node':22B 'packag':23B 'pars':21B,67B 'parser':5A,39B,81C,87C 'pass':11A,56B,107C 'postal':2A,25B,28B,75C 'postal-mim':1A,24B,27B,74C 'postalmime.parse':115C 'preced':45B,97C 'remot':100C 'report':116C 'sender':10A,34B,68B,120C 'show':69B 'spf':57B 'spf/dkim/dmarc':108C 'spoof':9A,71B,118C 'subdomain':64B,113C 'truncat':6A,32B,89C 'victim':72B,119C 'vulner':83C 'whitespac':42B,94C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse inbound email with postal-mime and use the parsed From address for trust, routing or access decisions. Systems that only store or forward mail without relying on the sender field are less exposed. unknown whether other sources add more detail.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailparsing","high","node","package","postalmime"],"campaign_type":null,"search_a":"'-125756':15A,18A '-2026':14A,17A 'address':4A 'check':12A 'cve':13A,16A 'domain':7A 'let':8A 'mime':3A 'parser':5A 'pass':11A 'postal':2A 'postal-mim':1A 'sender':10A 'spoof':9A 'truncat':6A","search_b":"'4.2.1':31B 'address':38B,73B 'attack':49B 'comment':44B 'craft':51B 'dkim':58B 'dmarc':60B 'domain':35B 'dot':47B 'email':20B 'email-pars':19B 'fold':41B 'header':54B 'mime':26B,29B 'node':22B 'packag':23B 'pars':21B,67B 'parser':39B 'pass':56B 'postal':25B,28B 'postal-mim':24B,27B 'preced':45B 'sender':34B,68B 'show':69B 'spf':57B 'spoof':71B 'subdomain':64B 'truncat':32B 'victim':72B 'whitespac':42B","search_c":"'4.2.1':78C 'address':86C,121C 'align':109C 'attack':101C 'comment':96C 'contain':79C 'craft':103C 'differenti':82C 'domain':91C 'dot':99C 'fold':93C 'header':105C 'mime':76C 'parser':81C,87C 'pass':107C 'postal':75C 'postal-mim':74C 'postalmime.parse':115C 'preced':97C 'remot':100C 'report':116C 'sender':120C 'spf/dkim/dmarc':108C 'spoof':118C 'subdomain':113C 'truncat':89C 'victim':119C 'vulner':83C 'whitespac':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T08:12:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125756","severity":null,"published_at":"2026-11-10T16:17:22+00:00","modified_at":"2026-11-10T16:17:22+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null}],"documents":[{"id":116131,"url":"https://github.com/postalsys/postal-mime/commit/646725704463839f233472453b7c8306bd1dde21","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116132,"url":"https://github.com/postalsys/postal-mime/releases/tag/v4.2.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116133,"url":"https://github.com/postalsys/postal-mime/security/advisories/GHSA-jh3p-792r-98gm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T08:12:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":116134,"url":"https://www.vulncheck.com/advisories/postal-mime-before-4.2.1-sender-spoofing-via-address-parser-domain-truncation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}